BankingNewsAI Daily Brief ·
Storm-0940 used ARTEX agentic AI to compromise the ConnectWise supply chain
Banking AI
Financial institutions & fintech technology
FDIC's Hill mulls agentic AI deposit impact
For the chief financial officer of a regional bank
The FDIC chair calls agents moving deposits 'the big thing' he is weighing, and three of the largest banks already block those agents. Your runoff model should price a depositor who never sleeps before an examiner asks.
An AI agent is software a customer authorizes to move money for them, such as Meta's Muse assistant paying through Stripe's Link wallet. The simple model: the agent checks rates and sweeps idle cash to whoever pays more, like a driver checking every gas station before filling up. The obvious question is why zero-rate balances have not already left. Hill's answer: depositors value other things. Inertia helps too. An agent removes the inertia. The exception is corporate money, about half of system deposits, often held for services, not yield. JPMorgan, Citi and Bank of America block outside agents. Hill says current model risk guidance does not work for agentic AI. Habit was never a line in the runoff model. It was holding the model up.
→ Action
Treasury and ALM: Add an agent-driven rate-sweep scenario to deposit runoff and liquidity stress tests, separating zero-rate retail from operational corporate balances.
Full story →Read article → from Banking Dive
JPMorgan, Citi and CIBC cap premium AI use as computing bills climb
For the CTO of a regional US bank
JPMorgan lets selected engineers spend up to $2,000 a month on Claude Code; CIBC saw premium models hit C$3,000 per employee. Usage-billed AI needs a spend ceiling and access tiers before agents reach production, not after the invoice.
Early bank AI deals worked like a gym membership: a fixed fee per user, paid monthly. More contracts now bill by usage, charging for the compute each answer burns. That is fine in a pilot. In production, thousands of staff and agents query models all day, and an agent running a multi-step task can cost far more than a question. JPMorgan spends about $700 million a year on AI and caps Claude Code at $2,000 per engineer per month. CIBC found premium models cost up to C$3,000 per employee a month and restricted access. Caps are blunt; they limit spend, not waste. The exception is efficient use: BBVA, by optimizing how it uses AI, cut a loan approval from €5 to €0.03. The cap sets the budget. The routing sets the bill.
→ Action
Technology procurement: Add per-user monthly spend ceilings and model access tiers to every usage-billed AI contract before agentic workloads go to production.
Full story →Read article → from Cryptobriefing
Stripe opens Treasury accounts to AI agents, keeping founders in approval loop
For the head of commercial banking at a regional bank
Stripe lets a founder's ChatGPT or Claude agent pay invoices from a Treasury account, with a human approving each live payment. The account sits at Fifth Third. Block agents, and the deposits still land at a bank, just not yours.
Stripe Treasury for agents lets a business connect ChatGPT or Claude to its Treasury account through Stripe's MCP server. The agent can check balances, pay invoices, move money between accounts and convert currencies. By default a person approves every live payment, so the agent works like a clerk who fills out checks and leaves them on the owner's desk to sign. That model is not right: owners can change the default, and an agent API key allows independent access, with spending limits still weeks away. The buyer is the one-person company. Solo founders were 63% of C corps formed through Stripe Atlas in the second quarter. Kubrio swapped three providers for one. Who holds the money? Fifth Third, which provides the checking accounts. The bank that said yes gets the deposits.
→ Action
Commercial deposits: Flag small-business outflows to Stripe Treasury and Fifth Third, and log which clients ask for agent or MCP account access.
Full story →Read article → from Webpronews
General AI
Large language models & AI infrastructure
Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise
For the CISO of a regional US bank
Your patch windows and app-consent reviews assume an attacker who sleeps. Storm-0940 went from first target to privileged cloud access in under three hours, through an app its victims had already approved.
ARTEX is software that runs a penetration test on its own. An AI agent tries several ways in at once, nights and weekends included. Storm-0940, a China-state aligned actor, aimed it at hundreds of organizations. The working path ran through a ConnectWise multi-tenant app already allowed into Microsoft 365, so no user had to sign in. Through Microsoft Graph, the agent scouted, changed app credentials and tried to raise privileges. Think of a contractor's master key: nobody checks it at the door. Microsoft says none of its own systems were breached, and that is the point. Some victims went from targeted to privileged access in under three hours. A quarterly consent review checks that key once every 2,000-plus hours.
→ Action
Identity security: Inventory third-party apps holding Microsoft 365 consent; alert within minutes on Graph-driven app credential or privilege changes.
Full story →Read article → from Microsoft
AI helps find vulnerability affecting up to 70% of websites
For the ciso of a regional us bank
Four European governments pulled their own websites offline rather than wait. The fix that protects your servers is also the attacker's map to them, so the patch clock started when it was published, not when your change board meets.
Web developers using AI found a flaw affecting up to 70% of the world's websites, and fixes are now public. France, Denmark, Finland and the Netherlands took government sites offline rather than run them unpatched. Why would a published fix make things worse? Because a patch shows what changed, and a researcher told Reuters that AI lets attackers read it back into an exploit and aim it at every vulnerable server. A posted lock repair tells burglars which doors were weak. The simple model is that patched means safe. The imperfect part: the item names no software, so you must find the exposure yourself. The exception is vendors' servers, which hold your customer data on someone else's patch calendar. You are only as patched as your slowest vendor.
→ Action
Vulnerability management: Inventory internet-facing and vendor-hosted web servers, apply the newly released fixes, and get written patch confirmation from critical vendors.
Full story →Read article → from Semafor
Claude Duet research preview opens to US Pro and Max users
For the head of digital banking at a US bank
Claude Duet will buy things for your customers but refuses to move money between their accounts. The bank first meets it as a one-time card at checkout, approved in a chat the bank never sees.
Claude Duet is a Claude assistant you message like a person. It runs on its own computer in the cloud and keeps working after you close the app. On sites without a connector, it uses its own cloud browser. It is a waitlist research preview for US Pro and Max users. Payments work in three steps. The agent asks, the customer says yes, and Link or Shop Pay issues a one-time card that works only for that purchase. Think of a house-sitter given a fresh key for each errand. The help page admits the agent can misread a thread. Moving money between accounts and trading securities are off-limits even with approval. So why should a bank care? A disputed purchase still reaches the bank, and all the bank holds is a card number.
→ Action
Card disputes: Define how claims citing a Claude Duet-approved one-time card purchase via Link or Shop Pay are adjudicated.
Full story →Read article → from Anthropic
Get this in your inbox every morning
Free · No spam · Unsubscribe anytime